hxxp://deme[.]stanford[.]edu

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 18:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://deme.stanford.edu
Sample260730-xgrt8seq7y

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4616	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134299110021436312"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
1044	chrome.exe
1044	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3008	chrome.exe
Token: SeCreatePagefilePrivilege	3008	chrome.exe
Token: SeShutdownPrivilege	3008	chrome.exe
Token: SeCreatePagefilePrivilege	3008	chrome.exe
Token: SeShutdownPrivilege	3008	chrome.exe
Token: SeCreatePagefilePrivilege	3008	chrome.exe
Token: SeShutdownPrivilege	3008	chrome.exe
Token: SeCreatePagefilePrivilege	3008	chrome.exe
Token: SeShutdownPrivilege	3008	chrome.exe
Token: SeCreatePagefilePrivilege	3008	chrome.exe
Token: SeShutdownPrivilege	3008	chrome.exe
Token: SeCreatePagefilePrivilege	3008	chrome.exe
Token: SeShutdownPrivilege	3008	chrome.exe
Token: SeCreatePagefilePrivilege	3008	chrome.exe
Token: SeShutdownPrivilege	3008	chrome.exe
Token: SeCreatePagefilePrivilege	3008	chrome.exe
Token: SeShutdownPrivilege	3008	chrome.exe
Token: SeCreatePagefilePrivilege	3008	chrome.exe
Token: SeShutdownPrivilege	3008	chrome.exe
Token: SeCreatePagefilePrivilege	3008	chrome.exe
Token: SeShutdownPrivilege	3008	chrome.exe
Token: SeCreatePagefilePrivilege	3008	chrome.exe
Token: SeShutdownPrivilege	3008	chrome.exe
Token: SeCreatePagefilePrivilege	3008	chrome.exe
Token: SeShutdownPrivilege	3008	chrome.exe
Token: SeCreatePagefilePrivilege	3008	chrome.exe
Token: SeShutdownPrivilege	3008	chrome.exe
Token: SeCreatePagefilePrivilege	3008	chrome.exe
Token: SeShutdownPrivilege	3008	chrome.exe
Token: SeCreatePagefilePrivilege	3008	chrome.exe
Token: SeShutdownPrivilege	3008	chrome.exe
Token: SeCreatePagefilePrivilege	3008	chrome.exe
Token: SeShutdownPrivilege	3008	chrome.exe
Token: SeCreatePagefilePrivilege	3008	chrome.exe
Token: SeShutdownPrivilege	3008	chrome.exe
Token: SeCreatePagefilePrivilege	3008	chrome.exe
Token: SeShutdownPrivilege	3008	chrome.exe
Token: SeCreatePagefilePrivilege	3008	chrome.exe
Token: SeShutdownPrivilege	3008	chrome.exe
Token: SeCreatePagefilePrivilege	3008	chrome.exe
Token: SeShutdownPrivilege	3008	chrome.exe
Token: SeCreatePagefilePrivilege	3008	chrome.exe
Token: SeShutdownPrivilege	3008	chrome.exe
Token: SeCreatePagefilePrivilege	3008	chrome.exe
Token: SeShutdownPrivilege	3008	chrome.exe
Token: SeCreatePagefilePrivilege	3008	chrome.exe
Token: SeShutdownPrivilege	3008	chrome.exe
Token: SeCreatePagefilePrivilege	3008	chrome.exe
Token: SeShutdownPrivilege	3008	chrome.exe
Token: SeCreatePagefilePrivilege	3008	chrome.exe
Token: SeShutdownPrivilege	3008	chrome.exe
Token: SeCreatePagefilePrivilege	3008	chrome.exe
Token: SeShutdownPrivilege	3008	chrome.exe
Token: SeCreatePagefilePrivilege	3008	chrome.exe
Token: SeShutdownPrivilege	3008	chrome.exe
Token: SeCreatePagefilePrivilege	3008	chrome.exe
Token: SeShutdownPrivilege	3008	chrome.exe
Token: SeCreatePagefilePrivilege	3008	chrome.exe
Token: SeShutdownPrivilege	3008	chrome.exe
Token: SeCreatePagefilePrivilege	3008	chrome.exe
Token: SeShutdownPrivilege	3008	chrome.exe
Token: SeCreatePagefilePrivilege	3008	chrome.exe
Token: SeShutdownPrivilege	3008	chrome.exe
Token: SeCreatePagefilePrivilege	3008	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe
3008	chrome.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 312	3008	chrome.exe	86
PID 3008 wrote to memory of 1148	3008	chrome.exe	87
PID 3008 wrote to memory of 1148	3008	chrome.exe	87
PID 3008 wrote to memory of 4616	3008	chrome.exe	88
PID 3008 wrote to memory of 1776	3008	chrome.exe	89
PID 3008 wrote to memory of 1776	3008	chrome.exe	89
PID 3008 wrote to memory of 4304	3008	chrome.exe	91
PID 3008 wrote to memory of 4668	3008	chrome.exe	92
PID 3008 wrote to memory of 4304	3008	chrome.exe	91
PID 3008 wrote to memory of 4668	3008	chrome.exe	92
PID 3008 wrote to memory of 4276	3008	chrome.exe	93
PID 3008 wrote to memory of 4276	3008	chrome.exe	93
PID 3008 wrote to memory of 2636	3008	chrome.exe	96
PID 3008 wrote to memory of 2636	3008	chrome.exe	96
PID 3008 wrote to memory of 4572	3008	chrome.exe	97
PID 3008 wrote to memory of 5008	3008	chrome.exe	100
PID 3008 wrote to memory of 5008	3008	chrome.exe	100
PID 3008 wrote to memory of 2744	3008	chrome.exe	102
PID 3008 wrote to memory of 2744	3008	chrome.exe	102
PID 3008 wrote to memory of 3656	3008	chrome.exe	112
PID 3008 wrote to memory of 220	3008	chrome.exe	113
PID 3008 wrote to memory of 212	3008	chrome.exe	114
PID 3008 wrote to memory of 4292	3008	chrome.exe	116
PID 3008 wrote to memory of 4292	3008	chrome.exe	116
PID 3008 wrote to memory of 2712	3008	chrome.exe	117
PID 3008 wrote to memory of 2712	3008	chrome.exe	117
PID 3008 wrote to memory of 1044	3008	chrome.exe	118

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://deme.stanford.edu
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0x84,0x104,0x7ffcab07c728,0x7ffcab07c734,0x7ffcab07c740
  2⤵
  PID:312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1668,i,9563013093646542189,5765001606072259191,262144 --field-trial-handle=1904,i,10868287417583317226,5063278425265211530,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1972 /prefetch:2
  2⤵
  PID:1148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1572,i,14772486983219976312,5168966536516528818,524288 --field-trial-handle=1904,i,10868287417583317226,5063278425265211530,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2280,i,4591468329319467956,1713250550771860461,524288 --field-trial-handle=1904,i,10868287417583317226,5063278425265211530,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2532 /prefetch:8
  2⤵
  PID:1776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3116,i,6015685382853098828,4161534858924719796,2097152 --field-trial-handle=1904,i,10868287417583317226,5063278425265211530,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3148 /prefetch:1
  2⤵
  PID:4304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3128,i,9479851036762327946,10716024795405467776,2097152 --field-trial-handle=1904,i,10868287417583317226,5063278425265211530,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:4668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4488,i,10273036372462708464,13397524562673023547,2097152 --field-trial-handle=1904,i,10868287417583317226,5063278425265211530,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4500 /prefetch:1
  2⤵
  PID:4276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3268,i,17718514657145558375,10657851828639747254,2097152 --field-trial-handle=1904,i,10868287417583317226,5063278425265211530,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:2636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5264,i,6127374362483134799,16038487977551412167,524288 --field-trial-handle=1904,i,10868287417583317226,5063278425265211530,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5272 /prefetch:8
  2⤵
  PID:4572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5312,i,10852131658851775188,8360738094828479045,2097152 --field-trial-handle=1904,i,10868287417583317226,5063278425265211530,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:5008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4408,i,11122115707417613909,2278452081668571659,2097152 --field-trial-handle=1904,i,10868287417583317226,5063278425265211530,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:2744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5304,i,4667142944163867611,4907011436268747200,524288 --field-trial-handle=1904,i,10868287417583317226,5063278425265211530,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5272 /prefetch:8
  2⤵
  PID:3656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4708,i,4761336348374248543,7888389450619329130,524288 --field-trial-handle=1904,i,10868287417583317226,5063278425265211530,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4540 /prefetch:8
  2⤵
  PID:220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5384,i,16177580974852131283,6414717261254788962,524288 --field-trial-handle=1904,i,10868287417583317226,5063278425265211530,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5524 /prefetch:8
  2⤵
  PID:212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4552,i,16871399238315748108,9227242629817082308,2097152 --field-trial-handle=1904,i,10868287417583317226,5063278425265211530,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3136 /prefetch:1
  2⤵
  PID:4292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3436,i,13960295483848129349,2721464552554628207,2097152 --field-trial-handle=1904,i,10868287417583317226,5063278425265211530,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:2712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5532,i,9365806485760941043,2540504153870410232,262144 --field-trial-handle=1904,i,10868287417583317226,5063278425265211530,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5568 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1044

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2012

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:860

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 4996cf950c014294ce772d0164af8620bb2d74e142b92edc7594367378fa0517
MD5 93c2767a9ebe70020e27a37682d39b95
SHA1 d9277293ce900d3d702fd1238bc55c445083ea0e
SHA512 e641e43b9120940013fc83556ca7a1614e9bb4974456163b5433a9668b14f00c0d3d9512d9de36d0e29776d2f9cda84e053485262cde46e950b3143192045fe7
TLSH
T152E02BBAC861EC3B19FE075864514746F610135B2B40894F7A3D860C9FF0B3A9A45C1C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 1fa58976430eda662dd817ba8e5e0b6ea0527874da6cbb8c31bb189e3a166429
MD5 b5cb5b2d2548c462bf47eb831beb5322
SHA1 82f0bc328345e55b6c579713d55b2a892c2524ad
SHA512 06c45c95c24f6fba3f60cb61f10ec73fb169a734e24579536061ca02c50c214cd01059c8d1d893ad69065f42544bafc4510eac69a065b01ff00cd9d74b21373a
TLSH
T19831AFF793B4857D8A1146F4DB11AF1FCE6A0524031C3C7688D46E2783E2872E10479F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 97f8f302b2083ba6c5058d1a33c0755025de3b95f577e90e467c96b6bf6f284f
MD5 ec4e94c182b94c798d9a598f7d96b80d
SHA1 e4773e1ca080ac8bf7c85f4da772ad6c4ae2ed63
SHA512 c73810a3f1676ee7d58c8478d95cfc0c92825a61570d7dd01bc11ec99b8a808d318229b0ad425f064e9ed43db74a9e2be197b79ad33bbc4cb0bff7388f3e8f91
SSDEEP 192:6RbuH59v72vAPRp25C9THwAb+WNnMePYXe5oU2C5VyIsnAUge:6RbuZ9C6X3FTzPxoU2Cfe
TLSH
T1A742B52EA920657B5CDBD21AF9617B67E7F6103176D42E80EAFC8A3C15D75CC222340B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 949e656f8ea238ec6f1d8b4b446f77506a03362869990c64fc5351f11bae6ad5
MD5 646534b72d913b8dafa02f5aab4884ae
SHA1 21cef3280bf5644687d1c8924773d124cec16b03
SHA512 33711f01c015bc3f1d5800b46b84f29f06504e23c14af62c63371abc513b712709333b355aeb753df74e115aa162ef4fcec57644170b47e69fa1ea0f2bc263da
SSDEEP 192:6RbuH5Nv72voPRpa5C9THw8b+WNnMePSXe5oU2CuVyIsnAUgE:6RbuZtCCXLFfzPfoU2CmE
TLSH
T16D42D62FA910697B5CDBD21AF9617B67E7F6103176902E40EAFC8A3C15E75CC221341B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 bb208da70a9dbb762ac5c26f3d24072db67f67eb607faaa6e7816c4e32f112c2
MD5 4cf0c8de2580012910525739e8a0ac00
SHA1 47acc7d71ab27e69d52b81e9a48fb8ef3472c347
SHA512 ee1fa8f6d1851ddadd1a6a5591f6adb18ca103f3ab2aaeb8b7c7b500a3ea1657d8474b8c2137ca3cd7c6beda251f1cb87a4532e68ca7779e7b106955db6ee909
SSDEEP 192:6RbuH5Nv72vAPRp25C9THw8b+WNnMePZXe5oU2CCVyIsnAUgE:6RbuZtC6X3FfzPSoU2CCE
TLSH
T1C142B62EA910657B5CDBD21AF9613B67E7F6103176D42E40EAFC8A3C15E75CC222341B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 df3f3d7e8eb52eb11376e73179228426d3d2d5efef9c19d4d305887505e18b02
MD5 cf7fedf8f7d2c16e2ee32aeccb0d6abd
SHA1 c0965f169b36b690aaf700b8f80359944a908774
SHA512 0f7e0c7f513e4fbb8754c44a17604a17a368e18bf06088e8c92d246667c4707e4e019b978bfef2975410552144093cebfb7ef11074676b8e4908dde7b23f6a1f
SSDEEP 192:ee14K6IW7KxkXqK4I40pUZNCgVLHrKHfFKslEK2cXzKD/Ty+ErUkKN9H9IB3Wh/+:/1jbW7KxkXqKf/pUZNCgVLH2Hfgslqcx
TLSH
T16F32C727948D9A3F4FECD55CDC526F4F6DB1029272780C2896FB9C0403A97CE115A1AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 e8ad5fc97aadc3f6a78d90175c1a9f77cef6b32a38863b0371b275a61a0b73c3
MD5 6bdac3fdeae22bddf9be0314c8b02049
SHA1 79438be47822f3ea3da5ea501dc56c8dda3ed80f
SHA512 e3760821ce2ce74bda0a038127db381ae09d7511ebfc55b7ad1c38a101ddd5c36700aa93958ab8a4664723c70f5672b4fae9a35c0788fbed05fdae51ac2088d6
SSDEEP 3072:SWGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMm:Shm7Rkm1tYpBeh2BAom
TLSH
T16DC3123B5D74E9365DB9B75FB08E0A1F1EF14AA2C920DA52C8D85B0433EA7CC1A45D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 ec866c7d711a122104d24b50510f33491002ced87eb16ba5b2907ddcf97d28ad
MD5 a087e9858cb5213acedcfc34bbe1a15d
SHA1 d3d12b0198830729820f032981429d3f74037d44
SHA512 66bf306e5c95693eee39c662bf60133a0a5e02f893fcc0a538d4a9d6a796e4da9a3f2241cb80c31d5f523575e85c0f697caa2a6005dc48bed2cddc94de9e45dd
SSDEEP 3072:5Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMm:4m7Rkm1tYpBeh2BAom
TLSH
T1C1C3123B5E71E9775979AB4EB08E0B1F1EF14AA2D930DA42C8D85A0437FA7CC1A05D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 63a0e40d536b001a178826b0f87b4ce40a7486611427de1b3fddba27c9947de9
MD5 dbf46779fe3ed38e37e3a9d8c28989ae
SHA1 5c3044bea3ac9f5ae706054b075d81e9d6177cfb
SHA512 38d3b638e138a9fc5b7c58a0730a5e7fa83115529ba6212cfa9b74ab354b9754e91ed19fe7f6dcc145e5ac07fd8bf2f9f6b6c9929f5f4bc7287a38b43fc177c6
SSDEEP 3072:XWGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMm:Xhm7Rkm1tYpBeh2BAom
TLSH
T15CC3123B5D74E9365DA9B75FB08E0A1F1EF14AA6C920DE52C8D85B0433EA7CC0A45D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 490bc7d518bf2f2c0ca0ed930bedf1a3f637c3104e70ddf1f8ffc0b579e000ab
MD5 88ec1f6ab3b83550c00d95e8cef4e7ff
SHA1 68e2e23e2194c7c63d042902bc06173254694ea6
SHA512 887a9623a0c6fdac52482672b8810efc55ed5678fc53a4f4db52cc4a1c6ddc46c330e74be940c5d8f4ba2ca9af89fb06a27d4f3f127fcb6c4e0396ade5ad832b
SSDEEP 3072:ZDGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMm:0m7Rkm1tYpBeh2BAom
TLSH
T1D9C3023B5D74A93759A9BB0FB04E0B1F1EF24AA6D930DA42C8D85E0433EA7CC1A45D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download